rule win_unidentified_104_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.unidentified_104."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_104"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4533c0 33d2 33c9 ff15???????? 4d8bc7 85c0 756d }
            // n = 7, score = 100
            //   4533c0               | add                 ecx, ecx
            //   33d2                 | inc                 ecx
            //   33c9                 | mov                 edi, dword ptr [edx + 0xc]
            //   ff15????????         |                     
            //   4d8bc7               | dec                 esp
            //   85c0                 | lea                 eax, [edx + 8]
            //   756d                 | dec                 eax

        $sequence_1 = { 45897710 48c1f919 488bc1 45895f18 48f7d8 45894f1c 48c1e019 }
            // n = 7, score = 100
            //   45897710             | lea                 edx, [0xd9e6]
            //   48c1f919             | dec                 eax
            //   488bc1               | lea                 ecx, [ebp + 0x20]
            //   45895f18             | inc                 ecx
            //   48f7d8               | lea                 edi, [esi + 0xf]
            //   45894f1c             | dec                 eax
            //   48c1e019             | mov                 dword ptr [ebp + 0x100], edi

        $sequence_2 = { 410fb6401b 4c0bc8 410fb6401a 49c1e108 4c0bc8 49c1e104 4c03c9 }
            // n = 7, score = 100
            //   410fb6401b           | jb                  0xe8
            //   4c0bc8               | dec                 esp
            //   410fb6401a           | lea                 ebx, [esp + 0x90]
            //   49c1e108             | dec                 ecx
            //   4c0bc8               | mov                 ebx, dword ptr [ebx + 0x10]
            //   49c1e104             | xor                 eax, eax
            //   4c03c9               | mov                 byte ptr [esp + eax + 0x70], 0

        $sequence_3 = { c5fe6f4540 83bd8001000001 7547 48bfb594a538405ffda7 48897d30 48bb066ea2152d99919e 48895d38 }
            // n = 7, score = 100
            //   c5fe6f4540           | inc                 eax
            //   83bd8001000001       | xor                 bh, bh
            //   7547                 | test                al, al
            //   48bfb594a538405ffda7     | je    0x7e5
            //   48897d30             | dec                 eax
            //   48bb066ea2152d99919e     | mov    eax, edi
            //   48895d38             | inc                 eax

        $sequence_4 = { 49ffc0 46383400 75f7 488d542420 488d4c2440 e8???????? 48b8e7f036c2995b4ac1 }
            // n = 7, score = 100
            //   49ffc0               | mov                 eax, dword ptr [edx + 0xb8]
            //   46383400             | dec                 ecx
            //   75f7                 | xor                 ecx, ebx
            //   488d542420           | dec                 eax
            //   488d4c2440           | add                 eax, ecx
            //   e8????????           |                     
            //   48b8e7f036c2995b4ac1     | dec    esp

        $sequence_5 = { 4803d0 488bc7 490fafc5 488b8c24c0000000 4c8bc3 4803d0 488b442408 }
            // n = 7, score = 100
            //   4803d0               | mov                 dword ptr [ebx + 0x20], eax
            //   488bc7               | dec                 eax
            //   490fafc5             | lea                 eax, [edx + 4]
            //   488b8c24c0000000     | dec                 eax
            //   4c8bc3               | mov                 dword ptr [ebx + 8], edx
            //   4803d0               | inc                 edx
            //   488b442408           | mov                 cl, byte ptr [ecx + edx + 0x17478]

        $sequence_6 = { 4833d5 4c8bc2 48c1e220 49c1e820 4c33c2 }
            // n = 5, score = 100
            //   4833d5               | arpl                ax, dx
            //   4c8bc2               | test                eax, eax
            //   48c1e220             | jle                 0x66
            //   49c1e820             | dec                 eax
            //   4c33c2               | lea                 edi, [0x6c31]

        $sequence_7 = { e8???????? b801000000 eb02 33c0 488b5c2440 488b742448 488b7c2450 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   b801000000           | mov                 byte ptr [eax - 2], cl
            //   eb02                 | shr                 eax, 0x10
            //   33c0                 | shr                 ecx, 0x18
            //   488b5c2440           | mov                 eax, ecx
            //   488b742448           | shr                 eax, 8
            //   488b7c2450           | inc                 ecx

        $sequence_8 = { 418848fe c1e810 c1e918 418800 41884801 4d8d4004 4983e901 }
            // n = 7, score = 100
            //   418848fe             | cmp                 eax, 0xf2744ba6
            //   c1e810               | jne                 0x5da
            //   c1e918               | dec                 eax
            //   418800               | lea                 eax, [0x4bb]
            //   41884801             | cmp                 eax, 0x3a229cc1
            //   4d8d4004             | jne                 0x5eb
            //   4983e901             | dec                 eax

        $sequence_9 = { 48ffc0 4883f810 72f2 83c8ff eb42 48c744242801000000 4c8d4dc7 }
            // n = 7, score = 100
            //   48ffc0               | dec                 eax
            //   4883f810             | xor                 edx, ebp
            //   72f2                 | dec                 eax
            //   83c8ff               | mov                 ebp, dword ptr [esp + 0x10]
            //   eb42                 | dec                 eax
            //   48c744242801000000     | add    ebp, edx
            //   4c8d4dc7             | dec                 esp

    condition:
        7 of them and filesize < 263168
}